I-OpenConnect kufanele iqhubeke isizama i-VPN ephukile isikhathi esingakanani?

--reconnect-timeout iphendula umbuzo owodwa omncane: ngemva kokuwa komhume, le nqubo yeklayenti iqhubeka izama isikhathi esingakanani ngaphambi kokuyeka nokuphuma. Ikhasi lemanuwali le-OpenConnect libhala lolo khetho ngenani eliyisisekelo elibhaliwe lamasekhondi angu-300 emizamweni emisha elandela isixhumanisi esilahlekile noma umlingani oyekile ukuphendula, futhi le nombolo iyisikhathi sokugcina sekhayenti eyodwa esebenzayo, hhayi ubufakazi bokuthi i-VPN ihlala ifinyeleleka. Futhi akusona isu lokugcina inqubo iphila, futhi ukudideka okuningi kuqala lapho.

Ukudideka kuyakhula lapho indlela yesibili ihlezi phezulu. Umbheki oqala kabusha iklayenti, umhloli ophinga isango, kanye newindi yemizamo emisha eyakhiwe ngaphakathi konke kungasabela ekwehlulekeni okukodwa, futhi isigameko sibe sesinikeza imigqa emithathu yesikhathi okungekho ongayihlanganisa.

Yini iwindi lokuxhumana kabusha eliyikhawulelayo ngempela

Cabanga ukuthi inethiwekhi yokufinyelela inyamalala imizuzwana embalwa. Iklayenti libona isixhumanisi siwa, noma liyeka ukuzwa izimpendulo zomlingani ofile, futhi liqala ukusungula kabusha isikhathi sokusebenza ngenkathi libambelela esimweni elingasikwazi. Imizamo iyaqhubeka kuze kube yilapho isango lamukela khona futhi noma iwindi liphela, futhi iwindi eliphelile liphetha ngokuphuma okungewona uziro. Yikho ukuphuma, hhayi inani lesikhathi sokugcina, okuyindawo lapho ubunikazi bomjikelezo wokuphila budlulela kumuntu ogada inqubo.

Iwindi alisho lutho mayelana nokuthi umhloli ugijima kaningi kangakanani, futhi alikwazi ukwelula ukuqinisekiswa. Uma isango likuhoxisile ukusebenza, noma i-akhawunti manje ifuna into yesibili entsha, ukulinda isikhathi eside ngeke kwenza isikhathi sokusebenza esidala sibe semthethweni futhi. Umzamo omusha uphumelela kuphela lapho indlela ibuya, isango lisayazi isikhathi sokusebenza, futhi izinkulumo zokungena eziceliwe zihlala zisebenziseka, ngakho funda le nombolo njengesikhathi sokugcina hhayi njengesikhala sokuphila.

Iwindi futhi alilawuli okwenziwa izinhlelo ngesikhathi ligijima. Kuye ngepulatifomu nokuthi ukwehluleka kufike kude kangakanani, iklayenti lingase lixhume kabusha nemizila isafakiwe, noma ngemva kokukhishwa kwayo. Yikho isicelo esikhishwe phakathi nokuphazamiseka sivame ukulenga kuze kuphele isikhathi esibekiwe esikhundleni sokwehluleka ngokushesha.

Ukuqalwa kabusha kombheki nemizamo yeklayenti kungamazinga amabili

Vumela iklayenti eligijimayo lisebenzise iwindi laso, futhi uvumele umphathi wensizakalo asabele ekuphumeni. Iklayenti elingaphambili ngaphansi kwe-systemd elinomgomo wokuqalisa kabusha linikeza impela lokho kwehlukanisa: imizamo isikhathi esilinganiselwe, bese kuba isinqumo esisodwa sokuqalisa kabusha. Umphumela umugqa wesikhathi owodwa ongakwazi ukuwuhlela kabusha kamuva.

Iklayenti elingemuva kanye nomhloli ozimele oqala elinye ikhophi uma engaboni isixhumanisi kuyiphethini engahambi kahle. Ngaleso sikhathi zombili izinqubo zincintisana nge-node yedivayisi efanayo, imizila kanye nezilungiselelo zesixazululi. Uma ngempela ufuna i-daemon, beka ukhetho emugqeni womyalo iklayenti eliqala ngawo ngempela:

sudo openconnect --background --pid-file=/run/openconnect/vpn.pid \
  --reconnect-timeout=180 \
  --user=<account> https://vpn.example.edu

Imininingwane emibili kulowo mugqa inesisindo. --background ihlukanisa inqubo, ngakho ifayela le-pid liba yisibambo esisodwa esithembekile kuyo, futhi isikhathi esibekiwe sisetshenziswa kuphela ngesikhathi leyo nqubo ifanayo iphila; umbheki oyibulalayo akashiyi sabiwomali sokuqhubeka.

Ukuxhumana okuphukile ngamabomu kudinga uphawu lwako. Ikhefu elihleliwe kanye nokuphazamiseka kwangempela kubonakala kufana kumqaphi ongenalwazi, futhi kokubili kufundwa njengokuthi «akuxhunyiwe». Qondisa ikhefu ngokusebenza kokumisa kombheki, noma ngophawu oluqondwa isisongelo, ukuze ukuma ngamabomu kungabi nesizathu sokuqalisa kabusha okungacelwanga muntu.

Ukuvimbela ukudluliselwa ukuthi kugijisane nomjikelezo wemizamo emisha

Ukululama okungagadiwe kuncike ezinkulumweni zokungena ezivuselelwa ngaphandle komuntu okhona. Isigaxa sokhiye esivuleka kuphela ngaphakathi kwesikhathi sedesktopi esisebenzisanayo, noma ithokheni elihlala lifuna ikhodi ebhaliwe, kuzoshiya iklayenti libambekile esigabeni sokuqinisekisa lapho indlela ibuya. Lungisa lowo mkhuba womsebenzi ngaphambi kokwelula iwindi, ngoba iwindi elide linikeza isicelo esifanayo esivinjiwe isikhathi esengeziwe sokwehluleka.

Ukuqinisekiswa kweseva akufanele kukhululeke ukuze kwehliswe izicelo. Ukufakwa kwe-pin noma i-ankile yokwethemba eqinisekisa isango yikho okwenza ukuxhumana kabusha okuzenzakalelayo kuphephe, futhi ukukucisha ukuze kugwenywe umbuzo wesitifiketi kushintsha ukuphazamiseka okubonakalayo kube okungabonakali. Gcina ubunikazi obuqinisekisiwe futhi ulungise isicelo esikhundleni salokho; iklayenti elizimisele ukuxhuma kunoma yisiphi isango libi kunalelo elimayo lilindile.

Ukuba khona kwesixhumanisi nakho akusona isibonakaliso sempilo. Idivayisi yomhume ingaba khona nesikhathi sokusebenza esifile ngemuva kwayo, futhi inqubo yokuqalisa ingaba khona ngaphandle komhume nhlobo. Akukho kulokhu okubonwayo okumelana nesicelo sangempela. Impilo kufanele ivele kulokho okudingwa umsebenzisi, njengesicelo esidlula emhumini siye ensizakalweni yangaphakathi eyaziwayo.

Yini okufanele iqinisekiswe ngesikhathi nangemva kokuphazamiseka

Qhuba izehlakalo ezine njengezivivinyo ezihlukene: ukuphazamiseka okufushane kunewindi, ukuphazamiseka okude kunakho, ukwehluleka kokuqinisekisa, kanye nokuma ngamabomu. Ngakunye kufanele kuphele esimweni esihlukile nesibikezelwayo, futhi umngcele phakathi kwezimbili zokuqala uyisizathu sonke sokukhetha inani.

Gcina izikhathi zokuhlola zibheke ngaphandle, ngoba ithebula lezinqubo lizibonakalisa okuncane kakhulu lodwa. Buka ukuthi i-pid ihlala izinzile yini phakathi nokunqanyulwa okufushane, bese uqinisekisa ukuthi ngemva kokude isihambile futhi yashintshwa kanye:

curl -sS --max-time 5 -o /dev/null -w '%{http_code}\n' https://intranet.example.internal/health
cat /run/openconnect/vpn.pid
ps -o pid,etime,cmd -p "$(cat /run/openconnect/vpn.pid)"

Phakathi nokuphazamiseka okufushane, qinisekisa ukuthi iklayenti lizame futhi ngempela esikhundleni sokuphuma ngaphambi kwesikhathi, nokuthi imizila kanye nokufakwa kwesixazululi kubuyile ngaphandle kokuphindwa. Okokuphazamiseka okude, qinisekisa ukuphuma okuhlanzekile kanye nokuqalisa kabusha okukodwa ngqo ngemva kwakho. Okokwehluleka kokuqinisekisa, qinisekisa ukuthi iklayenti alizungezi lizungeza isango elizoqhubeka nokulinqaba. Engeza ukuhlola ukuthi i-pid ibuyela enanini elilodwa esikhundleni sokunqwabelana.

Okokuma ngamabomu, i-URL yezempilo kufanele ihlale ingafinyeleleki futhi inqubo ihlale phansi. Bese uvala umjikelezo ohlangothini lohlelo: isicelo esifanayo kufanele sehluleke ngesikhathi umhume ungekho futhi kufanele siphumelele ngemva kokuba ubuyile, kusuka ekhelini lomthombo elilindelwe umgomo wakho. Isithonjana somhume esiluhlaza akusona ubufakazi, kodwa isicelo esiqediwe singubufakazi.